Resolve vulnerability: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
AI GENERATED PATCH
The suggested code changes were generated by GitLab Duo Vulnerability Resolution, an AI feature. Use this feature with caution. Before you apply the code changes, carefully review and test them, to ensure that they solve the vulnerability, don't harm the functional behavior of your application or introduce new vulnerabilities.
The large language model that generated the suggested code changes was only provided with the affected lines of code, and the vulnerability in that code. It is not aware of any functionality outside of this context.
Please see our documentation for more information about this feature. We'd love to hear your feedback so we can improve on this feature as we work to bring it to general availability.
Description:
Found subprocess function Popen with shell=True. This is dangerous because this call will
spawn the command using a shell process. Doing so propagates current shell settings and
variables,
which makes it much easier for a malicious actor to execute commands. Use shell=False
instead.
- Severity: critical
- Confidence: unknown
- Location: python/exec/rule-subprocess-popen-shell-true.py:54
Identifiers:
- A1:2017 - Injection
- CWE-78
- Bandit Test ID B602
- bandit.B602